HIPAA Security Rule Certification (NIST 800-66 R2)

While the US Department of Health and Human Services (HHS) does not offer a formal certification program for the Health Insurance Portability and Accountability Act (HIPAA), there is a legitimate way to obtain a HIPAA Security Rule certification for Covered Entities (CE) and Business Associates (BA).

The Secure Controls Framework (SCF) partnered with The Cyber AB to be the Accreditation Body (AB) for the SCF Conformity Assessment Program (SCF CAP). This enables organizations to offer a certification path for the HIPAA Security Rule where a SCF Third-Party Assessment Organization (3PAO) can certify an entity as SCF Certified - HIPAA Security Rule through a conformity assessment useing SCF controls.

Do You Need To Demonstrate Compliance With The HIPAA Security Rule?

ComplianceForge can help you demonstrate conformity with the requirements found in the HIPAA Security Rule and NIST SP 800-66 Rev 2. We can help ensure you have sufficient evidence of due diligence and due care to withstand external scrutiny that the requirements are sufficiently addressed.

HIPAA Certified The SCF CAP is focused on using the SCF as the control set to provide a company-level certification. While the SCF-CAP shares some similarities with other existing, single-focused certifications (e.g., ISO 27001, CMMC, FedRAMP, etc.), the SCF CAP is unique in its metaframework approach to covering cybersecurity and data protection requirements that span multiple laws, regulations and frameworks. Your Path To Demonstrating Conformity With The HIPAA Security Rule If you want to get SCF Certified for the HIPAA Security Rule, you can download the HIPAA Security Rule (NIST SP 800-66) Assessment Guide from the SCF's website. For organizations that have a current Cybersecurity Maturity Model Certification (CMMC) Level 2 certification and want to leverage reciprocity towards HIPAA Security Rule certification. (Note - this is only applicable if the organization holds a current CMMC L2 certification)

Secure Controls Framework Conformity Assessment Program (SCF CAP) - HIPAA Certification

The SCF CAP is designed for cybersecurity & privacy practitioners by cybersecurity & data privacy practitioners. This concept is based on the need within the industry for a tailored conformity assessment solution that is capable of addressing several key considerations:

• View compliance as a natural by-product of secure practices;
• Scale to address multifaceted operational requirements (e.g., laws, regulations and frameworks);
• Acknowledge the stated risk tolerance of the OSC since not all organizations have the same risk tolerance;
• Minimize the risk of “gaming” the certification process that provides no useful insights into the security posture of the OSA;
• Utilize technology to make the assessment process more efficient to drive down labor-related assessment costs; and
• Leverage existing industry recognized practices, where possible.

HIPAA Security Rule Structure Enables Certification

The lack of controls within HIPAA makes it difficult for organizations to demonstrate conformity with the framework. The solution is to leverage a controls framework that provides coverage for the HIPAA Security Rule and the SCF is that solution!

A HIPAA Security Rule-specific Assessment Guide (AG) is published for Organizations Seeking Assessment (OSA) to understand the assessment process. In addition to the SCF CAP’s assessment standards, the SCF CAP’s HIPAA Security Rule AG contains:

• Controls;
• Assessment Objectives (AOs); and
• Evidence Request List (ERL).

Comprehensive Controls Coverage For The HIPAA Security Rule & NIST SP 800-66 Rev 2

In adherence to NIST IR 8477, the SCF utilizes Set Theory Relationship Mapping (STRM) to provide crosswalk mapping between HIPAA Security Rule requirements to SCF controls.  The result is a defendable set of controls and Assessment Objectives (AOs) that can be assessed against to demonstrate conformity with the HIPAA Security Rule.

SCF Certification Process For The HIPAA Security Rule / NIST SP 800-66 Rev 2

The SCF CAP is designed to look at a holistic approach to cybersecurity and data protection. SCF assessors will evaluate your HIPAA Security Rule-specific approach to:

• Categorizing controls
• Selecting controls
• Implementing controls
• Assessing controls
• Authorizing controls
• Monitoring Controls

Steps To Earn Your HIPAA Security Rule Certification

To obtain HIPAA Securty Rule certification, these are the recommended steps:

• Contact ComplianceForge so that we can help you on your journey to demonstrate conformity with the HIPAA Security Rule;
• Download the NIST CSF 2.0 assessment guide and familiarize yourself with the SCF CAP process;
• Implement the necessary controls to demonstrate conformity;
• Perform an internal assessment to validate assumptions and necessary evidence; and
• Engage a SCF 3PAO to conduct a third-party conformity assessment.

ComplianceForge can help you step-by-step through this process from start to finish. We want you to be success to obtain a HIPAA Security Rule certification!

HIPAA Security Rule Assessments

ComplianceForge can provide gap assessment services to provide independent assurance of your cybersecurity program to determine how it conforms with the HIPAA Security Rule (NIST SP 800-66 Rev 2).

The SCF CAP is an authoritative structure to conduct Third Party Assessment, Attestation and Certification Services (3PAAC Services). The SCF CAP is a scalable, cost-effective solution for organizations to obtain an independent, third-party assessment of its cybersecurity & data protection practices.

The SCF CAP is specifically designed to be:

• An affordable solution for businesses to obtain certification of its cybersecurity and data protection capabilities.
• Scalable to address the modern reality facing businesses for multiple compliance obligations.
• Sustainable by businesses to minimize the reliance upon expensive consultants.

HIPAA Security Rule Certification Services

The SCF-based certification for the HIPAA Security Rule is designed to deliver significant value through an efficient third-party assessment process. The SCF CAP employs a rigorous third-party assessment process governed by The Cyber AB. This governance ensures SCF Third-Party Assessment Organizations (SCF 3PAOs) implement the highest level of assurance in certification results, reinforcing trust and credibility with stakeholders. The assessment process is prescriptive and the results are unbiased.

Successfully demonstrating conformity with NIST CSF 2.0 will lead to a SCF Certified – HIPAA Security Rule certification! 

StrikePath – Your HIPAA Security Rule Audit Partner

ComplianceForge has a strong working relationship with StrikePath to serve as your 3PAO for a HIPAA Security Rule assessment. StrikePath has expertise with ComplianceForge documentation and that can lead to a more efficient and cost-effective assessment process. Contact StrikePath to get on their calendar for your assessment! 

HIPAA / HITECH Policies, Standards & Procedures

ComplianceForge has editable policies, standards and procedures for HIPAA / HITECH to assist your organization earning a HIPAA Security Rule certification as part of the SCF CAP:

1. Digital Security Program (DSP)
   • Is an enterprise-class solution for SCF-based policies, control objectives, standards, guidelines, metrics and more.
   • Provides complete coverage for all SCF controls.
   • All SCF-based policies map 1-1 with SCF domains.
   • All SCF-based standards map 1-1 with SCF controls
   • Comes in both Word and Excel formats, so the DSP can be imported into a GRC platform that accepts policies and standards.
2. Cybersecurity Standardized Operating Procedures (CSOP)
   • Provides SCF-based procedures that compliment the standards in the DSP.
   • Provides complete coverage for all SCF controls.
   • All procedures map 1-1 with SCF controls.
   • Comes in both Word and Excel formats, so the CSOP can be imported into a GRC platform that accepts procedures.
3. NIST Cybersecurity Framework 2.0 (NIST CSF 2.0) Policies & Standards
   • Tailored for NIST CSF 2.0.
   • All SCF-based policies to address NIST CSF 2.0 requirements.
   • All SCF-based standards to address NIST CSF 2.0 requirements.
4. NIST CSF 2.0 Procedures
   • Tailored for NIST CSF 2.0.
   • All SCF-based procedures to address NIST CSF 2.0 requirements.